Refactor CORS/XHR to use GET.